SonicWall Urges Immediate Action on Critical SSLVPN Vulnerability

SonicWall has recently alerted IT administrators about a critical vulnerability affecting its firewalls. This particular flaw poses significant risks, as it is deemed “susceptible to actual exploitation.” As such, SonicWall has initiated communication with IT teams, stressing the urgency of applying the proposed fix to safeguard their networks and endpoints.

• Vulnerability Details: The vulnerability identified is an authentication bypass associated with SSL VPN and SSH management, tracked under the identifier CVE-2024-53704.
• Severity Score: This vulnerability has been assigned a severity score of 8.2, categorizing it as high risk.
• Affected Products: Multiple Generation 6 and Generation 7 firewalls that run on SonicOS versions 6.5.4.15-117n and earlier, as well as 7.0.1-5161 and previous versions, are impacted.

Vulnerability Exploitation Risks

The warning from SonicWall specifically highlights that customers utilizing SSL VPN or SSH management must act swiftly, as this vulnerability is high-risk (CVE Score 8.2) and vulnerable to actual exploitation. According to communications shared by some users on Reddit and reported by BleepingComputer, SonicWall emphasized the need to upgrade firmware immediately. This upgrading process is crucial for minimizing exposure to potential cyber threats.

Firmware Upgrade Recommendations

For users operating under Generation 6 or 6.5 hardware firewalls, the recommended firmware version for update is SonicOS 6.5.5.1-6n or newer. For Gen 6 / 6.5 NSv firewalls, the necessary firmware is SonicOS 6.5.4.v-21s-RC2457 or later. Users of TZ80 firewalls must ensure they have at least SonicOS 8.0.0-8037 installed.

• Critical Fix: The newly released firmware addresses the aforementioned high-risk vulnerability.
• Additional Vulnerabilities: In the same patch, SonicWall corrected three other vulnerabilities—CVE-2024-40762, CVE-2024-53705, and CVE-2024-53706—which facilitate authentication bypass and remote code execution.

Mitigation Measures for Immediate Action

For users who cannot apply the patch immediately, SonicWall recommends implementing a few mitigation strategies to enhance security posture. These include:

• Limit Access: Restrict access to trusted sources only, thereby reducing the attack surface.
• Disable SSLVPN Access: Consider disabling SSLVPN access from the Internet if feasible.
• SSH Management Restrictions: To mitigate potential impacts from SSH vulnerabilities, it is suggested to limit firewall management to trusted sources exclusively.
• Disable SSH Management from the Internet: This further reduces exposure to potential exploitation attempts.

It is imperative for network administrators to remain vigilant and proactive in applying these necessary updates and mitigation steps to protect their infrastructure against potential threats stemming from these vulnerabilities.

Additional Information and Resources

For more detailed information about these vulnerabilities and the corresponding firmware updates, IT admins can refer to the SonicWall Security Advisory. This resource provides comprehensive guidance on the required actions to secure their systems against these vulnerabilities.

• Thousands of SonicWall VPN devices are facing worrying security threats
• Explore the best antivirus tools available for comprehensive endpoint protection.
• Stay informed about the best endpoint protection tools currently on the market.